Posted
by
timothy
on Tuesday August 07, 2012 @09:57AM
from the internet-I-think-they-mean dept.

Nerval's Lobster writes "Between 4:52 and 5:12 on August 3, attackers used Wired writer Mat Honan's Apple ID to wipe his MacBook, before seizing control of his Gmail and other online identities ('My accounts were daisy-chained together,' he wrote in an Aug. 6 postmortem on Wired), and posting a message on Twitter for all to see: 'Clan Vv3 and Phobia hacked this twitter.' In the wake of Honan's high-profile hack, there are some key takeaways. Even if a typical user can't prevent a social-engineering attack on the company hosting their cloud account, they can armor their online life in ways that make attacks more difficult. First, two-factor authentication can prevent an attacker from seizing control of those vital 'hub' accounts (such as Gmail) where users tend to store much of their most vital information. Google offers two-step verification for signing in, as does Facebook. The truly security-conscious can also uncouple their cloud accounts; for example, making sure that iCloud and iTunes use two different sets of credentials. That might rob daily life in the cloud of some of its convenience, but it could also make you a harder target."Update: 08/08 01:17 GMT by S: This high-profile security breach has had an impact already: Apple has suspended password resets through customer support, and Amazon no longer lets users call in to change account settings.

How would SSH agent help here? They used social engineering at Amazon to get common account info, then further used social engineering to get the password reset on his Apple ID.

Once they had his Apple ID they logged into the iCloud service and issued remote wipes on all his devices that he had activated the wipe option on. Since he used the same credentials everywhere they were able to get into Twitter and Google as well.

As for loosing all his data, he should have had a backup. Apple makes this super

People use the same credentials on multiple web sites for convenience. Something like SSH agent could provide the same convenience, while allowing people to have different keys for different systems AND keeping all those keys in one secure place.

That's why I say "something like SSH agent". There's no technical reason we can't have a web based authentication mechanism that works the same way SSH agent does. Getting such a standard widely implemented would be the hard part.

For those that don't know how ssh-agent works:You have two parts to your key, one part encrypts only (public key) and the other part decrypts only (private key). The remote server sends a random message encrypted with the public key; that message is sent to the ssh-agent program, which decrypts the message with your private key which it has in memory. This decrypted message is sent back to the remote server -- if it matches what it randomly generated, it know that your are in possession of the private half of the key and lets you in. The secure part is that your private key is never sent over the wire, and never leaves the memory of the ssh-agent program (unlike a regular password).

Now one thing I've done in the past to make this more secure (when I carried a Nokia N900 linux-based phone) is I ran the agent on my phone only, and forwarded the connection to my PC via Bluetooth. I had it set up so that it would auto pair with PCs that I trusted (and play a particular sound on the pone during pairing and key usage), and require an accept button on the phone for other machines. I've been meaning to pick up Android programming so that I could port this over to my current phone. Oh, and when the agent program gets started on the phone, it requires a symmetric decryption key (protects it if the phone is stolen). Probably security overkill, but in my case I used it more for convenience than anything else.

In OS X and iOS this is called the Keychain. It already exists as an encrypted database that you can only get into with the password you put on it. Ideally this is something other than your login password, but most people probably don't think about it and use the same one anyways.

So for them to get at the private keys and/or stored passwords he must have used the same password for both login and the Keychain...

He should also look into FileVault... Even if Apple resets the login password, they don't ha

False, from my experience with at least reseting a password through the itunes side, you are required to give 3 bits of information not counting your apple id. I don't know if it's different for icloud but I'm planning on checking soon.
Remote-wipe is a part of find my mac which includes remote wiping.

As anyone who has been following this story from the beginning knows no real hacking took place, no encryption was broken, no keyswere stolen. The man used the same password for all his logins, and the "hacker" simply talked Apple support into handing overaccess to his account, and once one password was known, the hacker could log in everywhere.

What amazes me is how many people posted on the original thread here on slashdot their utter disbelief about how this happened, apparently astounded that Ap

As anyone who has been following this story from the beginning knows no real hacking took place, no encryption was broken, no keyswere stolen. The man used the same password for all his logins, and the "hacker" simply talked Apple support into handing overaccess to his account, and once one password was known, the hacker could log in everywhere.

What amazes me is how many people posted on the original thread here on slashdot their utter disbelief about how this happened, apparently astounded that Apple would do such a thing. Yet Social Engineering is one of the primary methods of spectacular security breaches.

Still one has to ask, why this guy was chosen as a target. I suspect the attacker had just that little piece of inside knowledge that gave him just enough to nudge the Apple tech over the brink.

He was chosen as a target because he had a 3-character twitter account name that the attacker wanted.

What? No, his passwords weren't the same. His email *addresses* followed a recognizable template, i.e. mhonan@whatever.com, and his password-recovery addresses were daisy-chained so that when they got into his Apple ID, they could reset his GMail, which could reset his Twitter.

"Apple tech support gave the hackers access to my iCloud account. Amazon tech support gave them the ability to see a piece of information — a partial credit card number — that Apple used to release information."

It was Apple that coughed up his credentials to the attackers. If Apple hadn't done that, there wouldn't be a problem.
There are some Apple employees that ought to lose their job over this and Apple ought to pay this guy something significant for screwing him over.

There are some Apple employees that ought to lose their job over this...

It shouldn't be the support person that answered the phone, though. Apparently they followed Apple's procedure of requiring only a billing address and the last four digits of a credit card number to gain access to the account.

Apparently they followed Apple's procedure of requiring only a billing address and the last four digits of a credit card number to gain access to the account.

It happens to make sense. It is so much more likely that such a call comes from a genuine customer in distress than from a hacker that, from a risk management point of view, that procedure is much better than telling a genuine customer "you should have been more careful, now you are hosed". Welcome to the real world.

Only the fist 6 and last 1 are "not random". The first 6 are the ISO number (formerly the BIN - Bank Identification Number) and are assigned to the card issuer, and the last is a check digit calculated from the full card number excluding the last digit. However, the last 4 are commonly printed on receipts, so they're not exactly "secret". But on a 16 digit number, that leaves digits 7-12 as relatively unknown (unless you have the full card number).

Not for Danish cards. Here, the first 4 are country and card type, the next 4 are the bank registration number. I would think this was the case for all non-American cards, but I could very well be wrong.

I didn't say it was a good policy. In fact, I'm completely in favor of firing the people that came up with it. If the support person confirmed all of the information that Apple's policy requires, then the fault should go to the people that set the policy, not the support person that followed it.

Seriously who forgets their Mother's maiden name or their first pets name?

Any idiot that actually replaces a high-security password with a low security, common knowledge item like MMN I hope to $diety never works as any type of admin in IT. I would assume anyone that thinks about it names their pets with a high-security name (like MD0km2!#nm1, or correct-horse-battery-staple if you prefer that style).

When I try to turn on two-factor authentication at Google, it gives me a screen that asks me for a phone number, and doesn't seem to have a way to bypass this. I'd rather not give them my phone number.

Their help pages say that you don't have to use SMS-based authentication. Apparently there is a setting, once two-factor authentication is enabled, to switch from receiving the codes via SMS, and instead either write down a batch of 10 "backup codes" at a time, or else install the Google Authenticator app, initialize it with a key, and then use it to generate tie-synchronized codes thereafter. Either of these solutions is fine with me. But how do I enable them without having to give Google my phone number on the initial screen?

If you use Google Voice to receive verification codes, you can easily create a situation where you’ve locked yourself out of your account.

For example, if you are signed out of your Google Voice app, you might need a verification code to get back in. However, you won’t be able to receive this verification code because it will be sent to your Google Voice, which you can’t access.

You have to have a phone to set it up. You can then disable the phone and re-enable it with:

> Mobile application> Switch to an app to get codes even when you don't have cell coverage.

And then remove your phone #. So at minimum it's going to cost you a burner phone.

The awesome thing about Google Authenticator is that it's open source. You can download and compile a PAM package (and it's in the Debian repositories). http://code.google.com/p/google-authenticator/ [google.com] So anything that uses PAM can use google authenticator.

I have it setup on my outward facing SSH server so to get into my house's server you're going to need my password and one of my devices.

You have something important enough (maybe email) on Google that you want 2-step authentication, and you're concerned about them having your phone number? What exactly are you afraid they can do with it? (I get the point of not wanting other information online)

This is precisely what I was wondering. If anything I want to establish more of a personal relationship with whichever cloud provider I throw my lot in with. On the off chance that Google abuses the personal contact information then you cut them off and blog to the heavens about it. I guarantee you the internet will eat it up and blog ads will more than pay for the pain and misery you suffered.

You don't have to give them YOUR phone number, nor does the phone have to be able to receive SMS.Google will use a computer voice to read the digits to you. This number does not need to be your permanent number.

You just need ANY phone number that you can answer.You will need it exactly twice.Once to set things up on your computer.Then again to get the Google Authentication app authorized. From then on you don't need to give them your phone number.

I'm sure there's people out there who are saying 'ooooh hacker skills', in that somebody managed to hack this guy's mail account (or snag his password). Bunch of amateur script kiddies who'd otherwise be huffing hair spray and smashing up bus shelters.

No, indeed, Gmail for a lot of people is the weakest link because it basically acts as the master key to one's online life.

That said, social engineering is a criminal skill, not a technical one. I've had a couple of friends who were quite serious crooks-- no prospects or skills, but got far by simply being able to blag things. In and out of jail their whole lives -- but then they were operating in the real world, where doing jail time comes with the territory. The Internet however is a free fire zone for sc

Unfortunately, in this case, at least on the Amazon side, it doesn't look like social engineering. It looks like a classic escalation attack in the same theme as the cuckoo egg: use weak credentials to deposit a payload that can then be used as strong credentials.

While social engineering is pernicious and relies on people violating policy in the name of being helpful or customer service (often without realizing they are doing it!), this is a straight up bug in the CS procedures.

Unfortunately, a similar bug in Apple's CS procedures allowed for further escalation.

No "hacker" should call himself such, by simply being able to sweet-talk a minimum wage drone over the phone.

You're being pedantic and glorifying the term 'hacker' way too much.

http://en.wikipedia.org/wiki/Kevin_mitnick [wikipedia.org] - this guy is usually referred to as a hacker, even though sweet talking minimum wage drones over the phone was his bread and butter. I get that you want to distinguish between the technologically adept and inept, using the terms 'hacker' and 'script kiddie' to do so, but the article is using the term 'hacker' in a legal sense; as in someone who commits crimes almost exclusively through the use of technology. My dad referred to himself as a hacker but he never committed a crime using his computer/phone. He just meant that he liked to hack out code.

Joe can be a man's name. Joe can be a cup of coffee. Joe can be a member of the armed services. Basically, you're arguing that your cup of coffee shouldn't be called Joe because that's your name.

hackers grab his info from whois because he has a personal site from bloggingthey use that to hack his amazon accountand then use the info from amazon to hack icloud

if he had just used wordpress or blogger or some other cloud service this hack would have been A LOT harder. it's 2012, no need to reinvent the wheel by setting up your own server for email, web site photo sharing or the 20 other things that da cloud has made easier and more secure. he just wanted to be uber tech cool and show off how he can run

Basically you're saying that no one should have an entry in the whois database because we can't have nice things.

Having a "helpful" customer service which disregards security best practices when it is "convinced" of a genuine need is also a nice thing. Publically posting your residential address on facebook and publically announcing your holiday itinerary on facebook is also a nice thing.

And yes, we can't have nice things. "Having nice things" is the enemy of security, and even privacy. What is wrong in saying we can't have nice things? (Except that it is obvious.)

Publically posting your residential address on facebook and publically announcing your holiday itinerary on facebook is also a nice thing.

Note that a residential address is not just something you post on Facebook, but something that exists in the yellow pages, on Google, and any number of direct mail, marketing, government, and tax databases -- it is public information which, by design, must be distributed to people holding any level trust, and is specifically not administered by the owner. Proposing that

It is useless to stick to publically posting residential address point. It becomes dangerous only in conjunction with associating it with facebook profile and publically posting one's vacation plans on facebook.

No one is advocating keeping one's residential address private. But advertizing it along with other information becomes dangerous as is well studied.

Hey, I have an idea. Let's stop using non-secret information as authentication credentials. Address, birthday, mother's maiden name, last 4 digits of CC or SSN, CVV, childhood pet's name are NOT AUTHENTICATION. Authentication information should never be printed, emailed, or typed in the clear.

Personally, I've been putting random numbers in all those fields for years, and if the account contains sensitive information, recording that information in an encrypted way in the event that it is ever needed. So far, I've never needed such information (because I also record and encrypt my randomly-generated passwords).

Get KeePass [keepass.info] and enable two factor authentication. Then, call your bank and CC company and tell them the security on your credit card is absurd. Because who cares how good your Google password is if the guy standing behind you at 7/11 can get all the info he needs to defraud you by holding out his camera-phone while you buy your Gatorade?

Nothing annoys me more than "security" questions. First, so many sites share the "secret" answer that it's really not secret, is it? Second, I'd prefer to not make vulnerable even yet more personally identifying information. Third, I really dislike needing to remember the hundreds of variations of stupid personal trivia that comprise my "answer". "In what city did you first drive a car?" How the hell should I know, I barely remember my name anymore!

I first drove my car in YKXz93W4MSGVn93z. You know it, it's 120 miles south of KrnummZF82cB5XXn. At least with these kinds of text entry fields, they're not going to require me to use one letter, one number, 2 forms of punctuation (but not an ampersand or dash!) and put a max length limit on the stupid thing.

Third, I really dislike needing to remember the hundreds of variations of stupid personal trivia that comprise my "answer". "In what city did you first drive a car?" How the hell should I know, I barely remember my name anymore!

Authentication is not the same as proof of identity. Authentication is not ID, nor is ID Authentication.

But how does one PROVE who they are? In order to PROVE you are who you are, you need a chain of trusted Identification.

1) Peter Knows Mary, Peter can ID Mary. But is Peter is not Trusted (yet)2) Paul ALSO knows Mary. Paul can also ID Mary, and Paul is trusted.3) Jane, Sue and Michael all know Mary. They all can ID Mary, but offer various levels of trust.

For 99% of internet applications, authentication is sufficient. Google, Apple, or any vendor doesn't need to know who I am, and they damn well don't need to link that info to my bank or tax records. It's none of their damn business. I don't want to identify myself.

All that is required is to identify that the person making the request is the same one that established the account. Pure authentication, no identification. We've all done ourselves a major disservice by muddling the two. Of course, Google

I don't see your point. What does that have to do with TFA? And why would I ever want to identify myself on the internet? As far as I'm concerned, there are two entities that need identity: banks and the government. All others don't need it, and induce liability, crime, and fraud by retaining identity information. With fraudulent identity information, one can perpetrate new fraudulent transactions with third parties unrelated to the source of the leaked identity information. With fraudulent authentica

Yap and idiot. Having insecure passwords over multiple different services is moronic at best. The fact that he has no backup when using cloud services is priceless and I bet he didn't even encrypt the data before putting it on an unknown server.
P.S: WTF is daisy-chained, saved passwords or same password across different accounts?
Use your passwords wisely and never let the OS save them if they are for important services, yes it takes more typing to access the mail, but this is what you do to be secure.

Because he's not the only idiot. You would be surprised how many tech savvy people have no backups and are equally vulnerable. Also it's something worth highlighting as it has shown critical flaws in bot Amazon and Apple's authentication systems. And it persuaded me to go ahead and set up 2-step authentication on Google, and I am damn glad I did.

I find that people complaining about the backup habits of other users are typically the ones with no solid backup plans themselves. Of course, I can't say if this is true in your case. You're correct in your assertion that he should've had backups, however.

Social engineering has everything to do with security, by the way. If you're vulnerable to social engineering (either via lack of proper security policies or a failure in training of personnel that have access to sensitive data), your security is compromi

When a password reset is requested, a new password is sent to your email address. So, if a hacker gains access to your primary email account, then he has access to ALL of your accounts. (In fact, since email isn't encrypted, he only has to be able to intercept the password-reset message somewhere in transit.)

This. I am amazed by the professionals in information handling who genuinely answer that Email is fine for exchanging sensitive information. I heard a hospital IT manager honestly answer that he thought that email of patient record via PDF was fine. Sigh.

It is no longer entirely true that e-mail is not encrypted. Many SMTP servers support encryption using SSL or TLS when communicating with another SMTP server. For example here is an example of an SMTP server receiving an e-mail from one of Google's gmail SMTP servers.

My current theory on cyber security is to put all of my eggs in a few baskets rather than spreading them out. My primary email accounts are operated by Google, with Google Authenticator providing two-factor security. I have LastPass providing complex and unique passwords for every website out there, and again, I have Google Authenticator providing two-factor security for that as well. Because LastPass has essentially scrambled all of my logins, I cannot access any website--including the email--without LastP

I use LP too, though I have to confess that I don't make full use of their password generation feature. I haven't tried the mobile apps - do those make it easy to log into sites from your phone? What about when you're at a different computer (not your own) - you simply use the mobile app to retrieve your password?

It doesn't surprise me in the least that clouds are not secure. I mean they are fluffy white things in the sky made mostly from water vapour. How can something like that be secure! Though they are someone intangible, and pretty hard to reach without some sort of assistance from earth. But hell birds can access them, birds! Do you think anything that birds can access is really secure?

Birds, the sky hackers!

Also Apple tech support sucks (believe me, I used to know some), and don't use the same password for everything...

I asked him why. Was I targeted specifically? Was this just to get to Gizmodo’s Twitter account? No, Phobia said they hadn’t even been aware that my account was linked to Gizmodo’s, that the Gizmodo linkage was just gravy. He said the hack was simply a grab for my three-character Twitter handle. That’s all they wanted. They just wanted to take it, and fuck shit up, and watch it burn. It wasn’t personal.